* [bitcoindev] Bitcoin Core security policy update
@ 2026-10-22 18:07 'Antoine Poinsot' via Bitcoin Development Mailing List
0 siblings, 0 replies; only message in thread
From: 'Antoine Poinsot' via Bitcoin Development Mailing List @ 2026-10-22 18:07 UTC (permalink / raw)
To: Bitcoin Development Mailing List
Hi,
We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered. This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.
Any security policy is going to make a tradeoff between two goals that are in tension: transparency and giving users sufficient time to upgrade. Transparency helps level the playing field between attackers and defenders, but can also make vulnerabilities public before users have upgraded.
Because of the nature of our project, coupled with a slow upgrade culture, our security policy favours a longer embargo period. This generally means security fixes can't be backported, and only become available with users along with the next major release.
For these issues that are easy to find, this is the wrong tradeoff. The embargo period achieves little but it delays the availability of a fixed release. We are therefore updating our policy disclosure to accommodate those.
During triage we may flag a vulnerability as easy to discover. In practice, we expect those to be issues that can be found with a simple prompt to an LLM, but the classification is not restricted to those. For such issues, we will backport a fix to all currently maintained releases, and cut a relase as soon as possible. We will publish some details in a security advisory along with the fixed releases.
Our updated security policy is available at https://bitcoincore.org/en/security-advisories
Antoine Poinsot
--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/1ehBdwhbU-1cUjU5SjRxn75XNUBvIfNbkfqPCJRFPlOfsBu5gHWotmNRNxcMirTl1baT2H-zBfJMeWM6rl-XJG8zV6gHf8vQ9b_TRB9vnIk%3D%40antoinep.com.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-22 18:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-22 18:07 [bitcoindev] Bitcoin Core security policy update 'Antoine Poinsot' via Bitcoin Development Mailing List
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox